@neverinfamous/mysql-mcp 2.1.0

package/src/adapters/mysql/tools/security/__tests__/encryption.test.ts

@@ -0,0 +1,156 @@
+import { describe, it, expect, vi, beforeEach, type Mock } from 'vitest';
+import { createSecuritySSLStatusTool, createSecurityEncryptionStatusTool, createSecurityPasswordValidateTool } from '../encryption.js';
+import { MySQLAdapter } from '../../../MySQLAdapter.js';
+
+describe('Security Encryption Tools', () => {
+    let mockAdapter: MySQLAdapter;
+    let mockExecuteQuery: Mock;
+
+    beforeEach(() => {
+        mockExecuteQuery = vi.fn();
+        mockAdapter = {
+            executeQuery: mockExecuteQuery
+        } as unknown as MySQLAdapter;
+    });
+
+    describe('mysql_security_ssl_status', () => {
+        it('should report SSL status correctly when enabled', async () => {
+            const tool = createSecuritySSLStatusTool(mockAdapter);
+            mockExecuteQuery
+                // SHOW STATUS LIKE 'Ssl%'
+                .mockResolvedValueOnce({
+                    rows: [
+                        { Variable_name: 'Ssl_cipher', Value: 'AES256-SHA' },
+                        { Variable_name: 'Ssl_version', Value: 'TLSv1.3' },
+                        { Variable_name: 'Ssl_accepts', Value: '10' },
+                        { Variable_name: 'Ssl_finished_accepts', Value: '10' }
+                    ]
+                })
+                // SHOW VARIABLES LIKE '%ssl%'
+                .mockResolvedValueOnce({
+                    rows: [
+                        { Variable_name: 'ssl_ca', Value: 'ca.pem' },
+                        { Variable_name: 'ssl_cert', Value: 'cert.pem' },
+                        { Variable_name: 'ssl_key', Value: 'key.pem' },
+                        { Variable_name: 'require_secure_transport', Value: 'ON' }
+                    ]
+                })
+                // Connection status
+                .mockResolvedValueOnce({
+                    rows: [{ cipher: 'AES256-SHA' }]
+                });
+
+            const result = await tool.handler({}, {} as any) as any;
+
+            expect(result).toEqual({
+                sslEnabled: true,
+                currentCipher: 'AES256-SHA',
+                sslVersion: 'TLSv1.3',
+                serverCertVerification: false, // Updated expectation
+                configuration: {
+                    sslCa: 'ca.pem',
+                    sslCert: 'cert.pem',
+                    sslKey: 'key.pem',
+                    requireSecureTransport: 'ON'
+                },
+                sessionStats: {
+                    acceptedConnects: '10',
+                    finishedConnects: '10'
+                }
+            });
+        });
+
+        it('should handle missing SSL information', async () => {
+            const tool = createSecuritySSLStatusTool(mockAdapter);
+            mockExecuteQuery
+                .mockResolvedValueOnce({ rows: [] }) // Status
+                .mockResolvedValueOnce({ rows: [] }) // Variables
+                .mockResolvedValueOnce({ rows: [] }); // Connection
+
+            const result = await tool.handler({}, {} as any) as any;
+
+            expect(result.sslEnabled).toBe(false);
+            expect(result.currentCipher).toBe('None');
+            expect(result.sslVersion).toBe('N/A');
+        });
+    });
+
+    describe('mysql_security_encryption_status', () => {
+        it('should report TDE status', async () => {
+            const tool = createSecurityEncryptionStatusTool(mockAdapter);
+            mockExecuteQuery
+                // keyring plugins
+                .mockResolvedValueOnce({
+                    rows: [{ PLUGIN_NAME: 'keyring_file', PLUGIN_STATUS: 'ACTIVE' }]
+                })
+                // tablespaces
+                .mockResolvedValueOnce({
+                    rows: [{ NAME: 'mysql', ENCRYPTION: 'Y' }]
+                })
+                // variables
+                .mockResolvedValueOnce({
+                    rows: [{ Variable_name: 'default_table_encryption', Value: 'ON' }]
+                })
+                // innodb variables
+                .mockResolvedValueOnce({
+                    rows: [{ Variable_name: 'innodb_redo_log_encrypt', Value: 'ON' }]
+                });
+
+            const result = await tool.handler({}, {} as any) as any;
+
+            expect(result.keyringInstalled).toBe(true);
+            expect(result.tdeAvailable).toBe(true);
+            expect(result.encryptedTablespaces).toHaveLength(1);
+            expect(result.encryptionSettings).toMatchObject({
+                default_table_encryption: 'ON',
+                innodb_redo_log_encrypt: 'ON'
+            });
+        });
+    });
+
+    describe('mysql_security_password_validate', () => {
+        it('should validate password strength', async () => {
+            const tool = createSecurityPasswordValidateTool(mockAdapter);
+            mockExecuteQuery
+                // VALIDATE_PASSWORD_STRENGTH
+                .mockResolvedValueOnce({
+                    rows: [{ strength: 100 }]
+                })
+                // SHOW VARIABLES
+                .mockResolvedValueOnce({
+                    rows: [
+                        { Variable_name: 'validate_password_policy', Value: 'STRONG' }
+                    ]
+                });
+
+            const result = await tool.handler({ password: 'StrongPassword123!' }, {} as any) as any;
+
+            expect(result.interpretation).toBe('Very Strong');
+            expect(result.meetsPolicy).toBe(true);
+        });
+
+        it('should handle weak passwords', async () => {
+            const tool = createSecurityPasswordValidateTool(mockAdapter);
+            mockExecuteQuery
+                .mockResolvedValueOnce({
+                    rows: [{ strength: 20 }]
+                })
+                .mockResolvedValueOnce({ rows: [] });
+
+            const result = await tool.handler({ password: '123' }, {} as any) as any;
+
+            expect(result.interpretation).toBe('Very Weak');
+            expect(result.meetsPolicy).toBe(false);
+        });
+
+        it('should handle component not installed error', async () => {
+            const tool = createSecurityPasswordValidateTool(mockAdapter);
+            mockExecuteQuery.mockRejectedValue(new Error('Function not found'));
+
+            const result = await tool.handler({ password: 'pass' }, {} as any) as any;
+
+            expect(result.available).toBe(false);
+            expect(result.message).toContain('not installed');
+        });
+    });
+});

package/src/adapters/mysql/tools/security/audit.ts

@@ -0,0 +1,272 @@
+/**
+ * MySQL Security - Audit and Firewall Tools  
+ * 
+ * Tools for security auditing, firewall monitoring, and compliance.
+ */
+
+import { z } from 'zod';
+import type { MySQLAdapter } from '../../MySQLAdapter.js';
+import type { ToolDefinition, RequestContext } from '../../../../types/index.js';
+
+// =============================================================================
+// Zod Schemas
+// ============================================================================
+
+const AuditLogSchema = z.object({
+    limit: z.number().default(100).describe('Maximum number of records'),
+    user: z.string().optional().describe('Filter by username'),
+    eventType: z.string().optional().describe('Filter by event type (e.g., "CONNECT", "QUERY")'),
+    startTime: z.string().optional().describe('Start time filter (ISO 8601)')
+});
+
+const FirewallRulesSchema = z.object({
+    user: z.string().optional().describe('Filter by username'),
+    mode: z.enum(['RECORDING', 'PROTECTING', 'DETECTING', 'OFF']).optional().describe('Filter by mode')
+});
+
+// =============================================================================
+// Tool Creation Functions
+// =============================================================================
+
+/**
+ * Query audit log
+ */
+export function createSecurityAuditTool(adapter: MySQLAdapter): ToolDefinition {
+    return {
+        name: 'mysql_security_audit',
+        title: 'MySQL Security Audit Log',
+        description: 'Query the MySQL audit log (requires Enterprise Audit or compatible plugin).',
+        group: 'security',
+        inputSchema: AuditLogSchema,
+        requiredScopes: ['admin'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { limit, user, eventType, startTime } = AuditLogSchema.parse(params);
+
+            // First check if audit log table exists
+            try {
+                const checkResult = await adapter.executeQuery(`
+                    SELECT TABLE_NAME 
+                    FROM information_schema.TABLES 
+                    WHERE TABLE_SCHEMA = 'mysql' 
+                      AND TABLE_NAME = 'audit_log'
+                `);
+
+                if (!checkResult.rows || checkResult.rows.length === 0) {
+                    // Try performance_schema alternative
+                    let query = `
+                        SELECT 
+                            EVENT_NAME as event,
+                            OBJECT_TYPE as objectType,
+                            OBJECT_NAME as objectName,
+                            CURRENT_USER as user,
+                            HOST as host,
+                            TIMER_START as startTime
+                        FROM performance_schema.events_statements_history
+                    `;
+
+                    const conditions: string[] = [];
+                    const queryParams: unknown[] = [];
+
+                    if (user) {
+                        conditions.push('CURRENT_USER LIKE ?');
+                        queryParams.push(`%${user}%`);
+                    }
+
+                    if (conditions.length > 0) {
+                        query += ' WHERE ' + conditions.join(' AND ');
+                    }
+
+                    query += ` ORDER BY TIMER_START DESC LIMIT ${String(limit)}`;
+
+                    const result = await adapter.executeQuery(query, queryParams);
+                    return {
+                        source: 'performance_schema',
+                        message: 'Using performance_schema as audit log is not available',
+                        events: result.rows ?? [],
+                        count: result.rows?.length ?? 0
+                    };
+                }
+
+                // Query actual audit log
+                let query = `
+                    SELECT *
+                    FROM mysql.audit_log
+                `;
+
+                const conditions: string[] = [];
+                const queryParams: unknown[] = [];
+
+                if (user) {
+                    conditions.push('user LIKE ?');
+                    queryParams.push(`%${user}%`);
+                }
+                if (eventType) {
+                    conditions.push('event_type = ?');
+                    queryParams.push(eventType);
+                }
+                if (startTime) {
+                    conditions.push('timestamp >= ?');
+                    queryParams.push(startTime);
+                }
+
+                if (conditions.length > 0) {
+                    query += ' WHERE ' + conditions.join(' AND ');
+                }
+
+                query += ` ORDER BY timestamp DESC LIMIT ${String(limit)}`;
+
+                const result = await adapter.executeQuery(query, queryParams);
+                return {
+                    source: 'mysql.audit_log',
+                    events: result.rows ?? [],
+                    count: result.rows?.length ?? 0
+                };
+            } catch {
+                return {
+                    available: false,
+                    message: 'Audit logging is not enabled. Install MySQL Enterprise Audit or Percona Audit plugin.',
+                    suggestion: 'Install audit plugin with: INSTALL PLUGIN audit_log SONAME "audit_log.so"'
+                };
+            }
+        }
+    };
+}
+
+/**
+ * Get firewall status
+ */
+export function createSecurityFirewallStatusTool(adapter: MySQLAdapter): ToolDefinition {
+    return {
+        name: 'mysql_security_firewall_status',
+        title: 'MySQL Firewall Status',
+        description: 'Get MySQL Enterprise Firewall plugin status.',
+        group: 'security',
+        inputSchema: z.object({}),
+        requiredScopes: ['read'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true
+        },
+        handler: async (_params: unknown, _context: RequestContext) => {
+            try {
+                // Check if firewall plugin is installed
+                const pluginResult = await adapter.executeQuery(`
+                    SELECT PLUGIN_NAME, PLUGIN_STATUS
+                    FROM information_schema.PLUGINS
+                    WHERE PLUGIN_NAME LIKE '%firewall%'
+                `);
+
+                if (!pluginResult.rows || pluginResult.rows.length === 0) {
+                    return {
+                        installed: false,
+                        message: 'MySQL Enterprise Firewall is not installed',
+                        suggestion: 'Install with: INSTALL PLUGIN mysql_firewall SONAME "firewall.so"'
+                    };
+                }
+
+                // Get firewall variables
+                const varsResult = await adapter.executeQuery(
+                    "SHOW VARIABLES LIKE 'mysql_firewall%'"
+                );
+
+                const variables: Record<string, unknown> = Object.fromEntries(
+                    (varsResult.rows ?? []).map(row => {
+                        const r = row;
+                        const varName = typeof r['Variable_name'] === 'string' ? r['Variable_name'] : '';
+                        return [varName, r['Value']];
+                    })
+                );
+
+                return {
+                    installed: true,
+                    plugins: pluginResult.rows,
+                    configuration: variables
+                };
+            } catch {
+                return {
+                    installed: false,
+                    message: 'Firewall plugin check failed',
+                    suggestion: 'Ensure you have privileges to view plugin information'
+                };
+            }
+        }
+    };
+}
+
+/**
+ * List firewall rules
+ */
+export function createSecurityFirewallRulesTool(adapter: MySQLAdapter): ToolDefinition {
+    return {
+        name: 'mysql_security_firewall_rules',
+        title: 'MySQL Firewall Rules',
+        description: 'List MySQL Enterprise Firewall allowlist rules.',
+        group: 'security',
+        inputSchema: FirewallRulesSchema,
+        requiredScopes: ['admin'],
+        annotations: {
+            readOnlyHint: true,
+            idempotentHint: true
+        },
+        handler: async (params: unknown, _context: RequestContext) => {
+            const { user, mode } = FirewallRulesSchema.parse(params);
+
+            try {
+                // Get firewall users
+                let usersQuery = `
+                    SELECT USERHOST, MODE
+                    FROM mysql.firewall_users
+                `;
+
+                const conditions: string[] = [];
+                const queryParams: unknown[] = [];
+
+                if (user) {
+                    conditions.push('USERHOST LIKE ?');
+                    queryParams.push(`%${user}%`);
+                }
+                if (mode) {
+                    conditions.push('MODE = ?');
+                    queryParams.push(mode);
+                }
+
+                if (conditions.length > 0) {
+                    usersQuery += ' WHERE ' + conditions.join(' AND ');
+                }
+
+                const usersResult = await adapter.executeQuery(usersQuery, queryParams);
+
+                // Get firewall whitelist
+                let rulesQuery = `
+                    SELECT USERHOST, RULE
+                    FROM mysql.firewall_whitelist
+                `;
+
+                if (user) {
+                    rulesQuery += ' WHERE USERHOST LIKE ?';
+                }
+
+                const rulesResult = await adapter.executeQuery(
+                    rulesQuery,
+                    user ? [`%${user}%`] : []
+                );
+
+                return {
+                    users: usersResult.rows ?? [],
+                    rules: rulesResult.rows ?? [],
+                    userCount: usersResult.rows?.length ?? 0,
+                    ruleCount: rulesResult.rows?.length ?? 0
+                };
+            } catch {
+                return {
+                    available: false,
+                    message: 'Firewall tables not accessible. Ensure MySQL Enterprise Firewall is installed and you have appropriate privileges.'
+                };
+            }
+        }
+    };
+}